Files
linux-stable-mirror/include/net
Julian Anastasov 342e24a339 ipvs: do not mangle ICMP replies for non-first fragments
Sashiko warns that ip_vs_nat_icmp() unconditionally mangles the
payload for embedded non-first IPv4 fragments. The problem is
in the very old inverted pp->dont_defrag check which should not
continue when embedded is a non-first TCP/UDP/SCTP fragment.

Check for embedded non-first fragment is also missing from
ip_vs_out_icmp_v6(), it is needed before any connection
lookups that expect ports after the network headers.

Drop the blocking code from ip_vs_in_icmp_v6() which prevents
ICMPv6 from local clients to use non-MASQ forwarding.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Link: https://sashiko.dev/#/patchset/20260720201122.79882-1-ja%40ssi.bg
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-07-23 18:08:22 +02:00
..
2025-04-24 17:03:45 -07:00
2025-07-08 18:05:25 -07:00
2026-05-21 13:04:42 +02:00
2025-08-26 17:34:31 -07:00
2026-01-21 19:28:32 -08:00
2025-09-18 12:32:06 +02:00
2025-04-11 18:58:10 -07:00
2025-07-04 09:32:35 +02:00
2025-09-08 18:06:21 -07:00
2025-07-11 11:00:57 -07:00
2026-03-13 18:57:44 -07:00
2026-04-06 18:43:51 -07:00
2026-03-16 19:28:21 -07:00